diff options
| author | Greg Kurz | 2016-06-27 18:28:15 +0200 |
|---|---|---|
| committer | David Gibson | 2016-07-01 01:57:01 +0200 |
| commit | dde35bc966ef8c1afb4f4e0f3c0e99fc0f27ca04 (patch) | |
| tree | fe272a607d788d49c0483c484c1ac42a339731fa /hw | |
| parent | hw/ppc/spapr: Add some missing hcall function set strings (diff) | |
| download | qemu-dde35bc966ef8c1afb4f4e0f3c0e99fc0f27ca04.tar.gz qemu-dde35bc966ef8c1afb4f4e0f3c0e99fc0f27ca04.tar.xz qemu-dde35bc966ef8c1afb4f4e0f3c0e99fc0f27ca04.zip | |
spapr: fix write-past-end-of-array error in cpu core device init code
This fixes a potential QEMU crash introduced by commit 3b542549661.
Signed-off-by: Greg Kurz <groug@kaod.org>
Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
Diffstat (limited to 'hw')
| -rw-r--r-- | hw/ppc/spapr_cpu_core.c | 3 |
1 files changed, 1 insertions, 2 deletions
diff --git a/hw/ppc/spapr_cpu_core.c b/hw/ppc/spapr_cpu_core.c index 3a5da09b99..8b802a6fcf 100644 --- a/hw/ppc/spapr_cpu_core.c +++ b/hw/ppc/spapr_cpu_core.c @@ -309,10 +309,9 @@ static void spapr_cpu_core_realize(DeviceState *dev, Error **errp) } err: - while (i >= 0) { + while (--i >= 0) { obj = sc->threads + i * size; object_unparent(obj); - i--; } g_free(sc->threads); error_propagate(errp, local_err); |